Buggy code:
public class SecurityRealmAddHandler implements OperationStepHandler { public static final SecurityRealmAddHandler INSTANCE = new SecurityRealmAddHandler ( ) ; @ Override public void execute ( OperationContext context , ModelNode operation ) throws OperationFailedException { } protected void installServices ( final OperationContext context , final String realmName , final ModelNode model , final ServiceVerificationHandler verificationHandler , final List < ServiceController < ? > > newControllers ) throws OperationFailedException { } private ServiceName addPlugInLoaderService ( String realmName , ModelNode plugInModel , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers ) { } private void addClientCertService ( String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , Injector < CallbackHandlerService > injector ) { } private void addJaasService ( OperationContext context , ModelNode jaas , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , boolean injectServerManager , ServiceBuilder < ? > realmBuilder , Injector < CallbackHandlerService > injector ) throws OperationFailedException { } private void addLdapService ( OperationContext context , ModelNode ldap , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , Injector < CallbackHandlerService > injector ) throws OperationFailedException { } private void addLocalService ( OperationContext context , ModelNode local , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , Injector < CallbackHandlerService > injector ) throws OperationFailedException { } private void addPlugInAuthenticationService ( OperationContext context , ModelNode model , String realmName , SecurityRealmService registry , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , Injector < CallbackHandlerService > injector ) throws OperationFailedException { } private void addPropertiesAuthenticationService ( OperationContext context , ModelNode properties , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , Injector < CallbackHandlerService > injector ) throws OperationFailedException { } private void addPropertiesAuthorizationService ( OperationContext context , ModelNode properties , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , InjectedValue < SubjectSupplementalService > injector ) throws OperationFailedException { } private void addPlugInAuthorizationService ( OperationContext context , ModelNode model , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , InjectedValue < SubjectSupplementalService > injector ) throws OperationFailedException { } private void addLdapAuthorizationService ( OperationContext context , ModelNode ldap , ServiceName realmServiceName , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , InjectedValue < SubjectSupplementalService > injector ) throws OperationFailedException { ServiceName ldapServiceName = realmServiceName . append ( SERVICE_SUFFIX ) ; final String baseDn = BASE_DN . resolveModelAttribute ( context , ldap ) . asString ( ) ; ModelNode node = USERNAME . resolveModelAttribute ( context , ldap ) ; final String usernameAttribute = ( node . isDefined ( ) ) ? node . asString ( ) : null ; node = ADVANCED_FILTER . resolveModelAttribute ( context , ldap ) ; final String advancedFilter = ( node . isDefined ( ) ) ? node . asString ( ) : null ; final boolean recursive = RECURSIVE . resolveModelAttribute ( context , ldap ) . asBoolean ( ) ; final boolean reverseGroup = REVERSE_GROUP . resolveModelAttribute ( context , ldap ) . asBoolean ( ) ; <START_BUG> final String rolesDn = ROLES_DN . resolveModelAttribute ( context , ldap ) . asString ( ) ; <END_BUG> final String pattern = PATTERN . resolveModelAttribute ( context , ldap ) . asString ( ) ; final String userDn = USER_DN . resolveModelAttribute ( context , ldap ) . asString ( ) ; ModelNode groupNode = GROUP . resolveModelAttribute ( context , ldap ) ; final int group = ( groupNode . isDefined ( ) ) ? GROUP . resolveModelAttribute ( context , ldap ) . asInt ( ) : 0 ; final ModelNode resultPatternNode = RESULT_PATTERN . resolveModelAttribute ( context , ldap ) ; final String resultPattern = ( resultPatternNode . isDefined ( ) ) ? resultPatternNode . asString ( ) : null ; LdapSubjectSupplemental ldapSubjectHandler = new LdapSubjectSupplemental ( recursive , rolesDn , baseDn , userDn , usernameAttribute , advancedFilter , pattern , group , resultPattern , reverseGroup ) ; ServiceBuilder < ? > ldapBuilder = serviceTarget . addService ( ldapServiceName , ldapSubjectHandler ) ; String connectionManager = CONNECTION . resolveModelAttribute ( context , ldap ) . asString ( ) ; ServiceUtil . addDependency ( ldapBuilder , ldapSubjectHandler . getConnectionManagerInjector ( ) , connectionManager , false ) ; final ServiceController < ? > serviceController = ldapBuilder . setInitialMode ( ON_DEMAND ) . install ( ) ; if ( newControllers != null ) { newControllers . add ( serviceController ) ; } SubjectSupplementalService . ServiceUtil . addDependency ( realmBuilder , injector , ldapServiceName , false ) ; } private void addSSLService ( OperationContext context , ModelNode ssl , ModelNode trustStore , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , InjectedValue < SSLIdentity > injector ) throws OperationFailedException { } private static class KeyPair { private char [ ] keystorePassword ; private char [ ] keyPassword ; } private SecurityRealmAddHandler . KeyPair addFileKeystoreService ( OperationContext context , ModelNode ssl , ServiceName serviceName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers ) throws OperationFailedException { } private void addSecretService ( OperationContext context , ModelNode secret , String realmName , ServiceTarget serviceTarget , List < ServiceController < ? > > newControllers , ServiceBuilder < ? > realmBuilder , Injector < CallbackHandlerFactory > injector ) throws OperationFailedException { }

Fix:
final String rolesDn = GROUPS_DN . resolveModelAttribute ( context , ldap ) . asString ( ) ;